fix(noema-review): close item13 stale-head native-cancellation race

.github/workflows/noema-review.yml

@@ -14,17 +14,6 @@ on:
   repository_dispatch:
     types: [noema-review]
 
-concurrency:
-  # Workflow-level admission retires an older queued head without waiting for
-  # the model job or its API cleanup job to receive a runner.
-  group: >-
-    required-noema-review-${{
-    github.event.pull_request.base.repo.full_name ||
-    github.event.client_payload.target_repository || github.repository }}-${{
-    github.event.pull_request.number ||
-    github.event.client_payload.pr_number || github.run_id }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
   pull-requests: read
@@ -229,6 +218,17 @@ jobs:
     name: noema-review
     needs: [admit-current-head]
     runs-on: ubuntu-24.04
+    # Only an exact live head reaches this group. Keeping concurrency at the
+    # job level prevents a delayed stale event from cancelling the current
+    # workflow before admit-current-head can reject it.
+    concurrency:
+      group: >-
+        required-noema-review-${{
+        github.event.pull_request.base.repo.full_name ||
+        github.event.client_payload.target_repository || github.repository }}-${{
+        github.event.pull_request.number ||
+        github.event.client_payload.pr_number || github.run_id }}
+      cancel-in-progress: true
     # No job-level timeout-minutes here, deliberately. This job's "Prepare
     # Noema model verdict" step calls two_phase.py's call_llm synchronously
     # via the contextual-orchestrator gateway and blocks on the model's own

tests/test_required_workflow_queue_contract.py

@@ -268,7 +268,8 @@ def test_required_pull_request_workflows_cancel_superseded_runs() -> None:
         assert "github.event.pull_request.base.repo.full_name" in concurrency_contract
         assert "github.repository" in concurrency_contract
         assert "github.event.pull_request.number" in workflow
-        assert re.search(r"(?m)^concurrency:", workflow)
+        if filename != "noema-review.yml":
+            assert re.search(r"(?m)^concurrency:", workflow)
         assert "cancel-in-progress: true" in concurrency_contract
         if filename == "security-scan.yml":
             assert (
@@ -279,6 +280,8 @@ def test_required_pull_request_workflows_cancel_superseded_runs() -> None:
             assert "required-opencode-review-${{" in concurrency_contract
             assert "outputs.admitted == 'true'" in workflow
         elif filename == "noema-review.yml":
+            assert not re.search(r"(?m)^concurrency:", workflow)
+            assert re.search(r"(?m)^    concurrency:", workflow)
             assert "github.event.workflow_run" not in concurrency_contract
             assert "required-noema-review-${{" in concurrency_contract
             assert "outputs.admitted == 'true'" in workflow
@@ -699,8 +702,8 @@ def test_noema_triggers_preserve_standalone_pull_request_review() -> None:
     """Noema reviews PRs independently of the other review workflows."""
     workflow = workflow_text("noema-review.yml")
     noema_job = workflow.split("\n  noema-review:\n", 1)[1]
-    concurrency_contract = workflow.split("\nconcurrency:\n", 1)[1].split(
-        "\npermissions:\n", 1
+    concurrency_contract = noema_job.split("    concurrency:\n", 1)[1].split(
+        "    permissions:\n", 1
     )[0]
 
     assert "workflow_run:" not in concurrency_contract
@@ -712,7 +715,10 @@ def test_noema_triggers_preserve_standalone_pull_request_review() -> None:
         "cancel-in-progress:", 1
     )[0]
     assert "cancel-in-progress: true" in concurrency_contract
-    assert "    concurrency:" not in noema_job.split("    permissions:", 1)[0]
+    assert not re.search(r"(?m)^concurrency:", workflow)
+    assert workflow.index("  admit-current-head:") < workflow.index(
+        "    concurrency:", workflow.index("  noema-review:")
+    )
     assert "needs.admit-current-head.outputs.admitted == 'true'" in noema_job
     assert '[ "${live_head_sha,,}" != "${EXPECTED_HEAD_SHA,,}" ]' in workflow